[PATCH] ima: select the SHA384 PCR bank for the boot aggregate

[Singh, Jashandeep]

From: Jashandeep Singh <jdsw at juniper.net>

ima_calc_boot_aggregate() selects a TPM PCR bank matching the
configured IMA hash algorithm, otherwise falling back to the SHA256
bank or the SHA1 bank.

A TPM 2.0 can be provisioned with only the SHA384 bank enabled, with no
SHA256 or SHA1 bank. None of the above then matched, selection failed
with

    ima: No suitable TPM algorithm for boot aggregate

and the boot aggregate digest was left as zeros, as for TPM bypass,
making remote attestation impossible.

Accept the SHA384 bank as a fallback. The configured IMA hash algorithm
is still matched first.

Signed-off-by: Jashandeep Singh <jdsw at juniper.net>
---
 security/integrity/ima/ima_crypto.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c
index 0d72b48249ee..c7a60b438955 100644
--- a/security/integrity/ima/ima_crypto.c
+++ b/security/integrity/ima/ima_crypto.c
@@ -491,7 +491,8 @@ int ima_calc_boot_aggregate(struct ima_digest_data *hash)
 			break;
 		}
 
-		if (crypto_id == HASH_ALGO_SHA256)
+		if (crypto_id == HASH_ALGO_SHA256 ||
+		    crypto_id == HASH_ALGO_SHA384)
 			bank_idx = i;
 
 		if (bank_idx == -1 && crypto_id == HASH_ALGO_SHA1)
-- 
2.34.1